Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. This vulnerability is fixed in 1.6.3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-13 | 3 | Disclosure2Patch1 |
| 2026-02-14 | 2 | Disclosure1Patch1 |
| 2026-02-15 | 1 | Disclosure1 |
| 2026-02-16 | 1 | General1 |
| 2026-02-18 | 1 | Disclosure1 |
| 2026-02-20 | 1 | General1 |
📊 CVE-2026-26273: The Over-Helpful Doorman: Full Account Takeover in 'Known' CMS: shi_gandang analy... Here's what you need to know: 1/3
Post summary
The text only references CVE‑2026‑26273 without providing further details such as proof‑of‑concepts, exploitation tools, or mitigation information.
📊 CVE-2026-26273: The Over-Helpful Doorman: Full Account Takeover in 'Known' CMS: shi_gandang analy... Here's what you need to know: 1/3
Post summary
The snippet announces CVE‑2026‑26273 with a full account takeover flaw in a CMS, but offers no PoC, exploit code, patch, or evidence of active exploitation.
📊 CVE-2026-26273: The Over-Helpful Doorman: Full Account Takeover in 'Known' CMS: shi_gandang analy... Here's what you need to know: 1/3
Post summary
The tweet references CVE-2026-26273 as a full account takeover vulnerability in a known CMS, but offers no PoC, exploit details, patch information, or evidence of active exploitation.
CVE-2026-26273 Critical Broken Authentication Vulnerability in Known Platform Versions 1.6.2 and Earlier https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26273
Post summary
CVE-2026-26273 is a critical broken authentication vulnerability affecting platform versions 1.6.2 and earlier; the text provides a disclosure with no PoC, exploit, or patch information.
CVE-2026-26273 Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the pas… https://www.cve.org/CVERecord?id=CVE-2026-26273
Post summary
The CVE describes a critical broken authentication vulnerability in Known versions 1.6.2 and earlier, resolved by upgrading to version 1.6.3.
🚨 CVE-2026-26273: Known affected by Account Takeov... Rookie mistake: Known devs exposed reset tokens in HTML source, enabling trivial account takeover with just an email ad... https://zerodaysignal.com/vulnerability/CVE-2026-26273 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE-2026-26273, noting that reset tokens are exposed in HTML and allowing trivial account takeover, but provides no patch or exploit details.
🚨 CRITICAL: CVE-2026-26273 in Known <1.6.3 exposes password reset tokens, enabling full account takeover — no email access needed! Patch to 1.6.3 ASAP. 🔒 https://radar.offseq.com/threat/cve-2026-26273-cwe-200-exposure-of-sensitive-infor-d59f1dbb #OffSeq #CVE202626273 #Infosec https://t.co/9zmd3sjy1R
Post summary
The tweet highlights a critical flaw (CVE‑2026‑26273) that leaks password reset tokens for account takeover and urges users to update to version 1.6.3 immediately.
CVE-2026-26273: The Over-Helpful Doorman: Full Account Takeover in 'Known' CMS CVE-2026-26273 is a catastrophic logic flaw in the 'Known' social publishing platform that turns the password reset mechanism into an open buffet for attackers. By simply k... https://cvereports.com/reports/CVE-2026-26273
Post summary
CVE‑2026‑26273 is a logic flaw in the Known CMS that exploits the password reset workflow, enabling attackers to perform full account takeover.
🔴 CVE-2026-26273 - Critical Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token wit... https://www.thehackerwire.com/vulnerability/CVE-2026-26273/ https://t.co/FB2hCjmpsN
Post summary
The text announces a critical CVE-2026-26273 affecting Known 1.6.2 and earlier, describing a broken authentication flaw that leaks password reset tokens.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | withknown | known | - | - | - |